Health Information Security and Sensemaking

1
Health Information Security and Sensemaking

• Ted Cooper, MD, Stanford
• Jeff Collmann, PhD, Georgetown
• Henry Neidermeier, PhD, Kaiser

2
The Case

• Cascading series of errors produced a breach of
  confidentiality and integrity of 800 patient
  emails on KP Online, Kaisers internet patient
  portal in August 2000.
• KP-IT mobilized a crisis situation management
  team to respond
• Response to breach initiated process of
  organizational reform and development

3
Organizational Sensemaking

• Sensemaking Occurs as Active agents construct
  sensible, sensable events Weick 1995)
• The security breach engendered organizational
  nonsense by disrupting the conditions of
  sensemaking in the KP Online program

4
Hypothesis

• Kaiser mobilized
• Organizational repertoire that restored sense to
  the KP Online program through
• Organizational rite of transition that identified
  and launched changes in the structure, management
  and process of the entire IT program.

5
Compartmentalized sensemaking

• Identity KP-IT units maintained different work
  procedures that reflected deeper differences of
  identity
• Ongoing events series of errors in context of
  major technical, management and organizational
  transitions
• Cues and retrospective sensemaking errors
  reflected compartmentalization and became
  starting points for retrospective analysis of
  situation management team

6
Organizational repertoire

• Embedded ethics
• Concern for member well-being
• Aggressive internal communications
• Open business practices
• Resource individuals
• Technical IT expertise
• Cultural and organizational expertise
• Guided by legal counsel as senior expert in
  Kaiser organizational repertoire
• Practiced procedures
• Critical situation management team
• Post-implementation review team

7
Organizational rite of transition

• Segregation
• Crisis situation management team
• Left everyday work routine to address failures
• Returned from leave
• Worked over the weekend
• Focused entirely on this issue

8
Organizational rite of transition

• Liminality
• Identity surrender technical and cultural
  compartmentalization to work as a team
• Ongoing events install mature system
  development processes with appropriate testing
• Cues and retrospective sensemaking extend
  experience of Kaisers organizational repertoire
  to entire KP-IT program, particularly web
  development

9
Organizational rite of transition

• Reaggregation
• Discovered KP Onlines value and risk
• Organizational epiphany
• Passed from immature adolescence to mature
  adulthood of web development

10
CEOs benediction

• I was very proud of the way Kaiser responded to
  this event. Not many organizations would have
  been as honest and ethical. Best of all, I
  remember being called to (the Kaiser CEOs)
  office. Instead of being bawled out, he thanked
  us for all the work cleaning up the problem and,
  most of all, . for pushing the envelope in
  putting up the KP Online. We were driving
  towards the future. Mistakes would be made. It
  was important to own them, fix them and not let
  them stop us moving forward. It was one of my
  proudest moments as a Kaiser employee.
• Senior KP-IT engineer